Networking-Forums.com

Professional Discussions => Security => Topic started by: deanwebb on April 13, 2015, 12:51:53 PM

Title: Guest Wireless Security Rant
Post by: deanwebb on April 13, 2015, 12:51:53 PM
We don't want our guest network to be totally wide open, so we will implement some security. Guests will have to authenticate to get on.

So, I get to find the solution...

Having the authenticator on the internal network created a problem because we can't have use our internal DNS domain on the Internet.

So, I build an authenticating box in the DMZ and set it to be managed by an internal system... which proceeds to place it automatically into the internal DNS domain.

I could make it a standalone box, which solves that problem... but the IP address that I was told to put on it by one group is unacceptable to the group in charge of the external DNS. I need to change that IP. Which is fine, except for the fact that the license I just put on it IS BOUND TO THE IP ADDRESS.

:wall:

This won't just be starting over. This will be starting over in deep and profound ways.
Title: Re: Guest Wireless Security Rant
Post by: SimonV on April 13, 2015, 02:13:12 PM
Doesn't your solution do DNS intercept? That way you could hand out public DNS servers but still redirect the first requests to your auth page

Title: Re: Guest Wireless Security Rant
Post by: deanwebb on April 13, 2015, 02:22:01 PM
It does do a DNS intercept, the trick is getting it to *be* in the right place for our network.

For security, we don't allow external DNS to resolve internal hosts and vice-versa. That makes this solution a non-slam-dunk.
Title: Re: Guest Wireless Security Rant
Post by: deanwebb on April 14, 2015, 10:02:58 AM
Troubleshooting procedure:

1. Google
2. Click all over the GUI
3. Type in a lot of ? in the CLI
4. Have my manager yell at the vendor
:developers:
5. Vendor uses Google
6. Vendor shows me the goofy spot in the GUI where DNS and domain settings are managed... Under "Mail"...  :angry:


Now it works like a top.
Title: Re: Guest Wireless Security Rant
Post by: Nerm on April 14, 2015, 11:57:54 AM
 :lol:
Title: Re: Guest Wireless Security Rant
Post by: deanwebb on April 14, 2015, 12:20:55 PM
Quote from: Nerm on April 14, 2015, 11:57:54 AM
:lol:

Quoted for truth.
Title: Re: Guest Wireless Security Rant
Post by: dlots on April 16, 2015, 02:55:34 PM
Can you make it a stand alone box, and NAT it to the IP address they want it to use, and use the IP address it has for the actual IP address?
Title: Re: Guest Wireless Security Rant
Post by: deanwebb on April 16, 2015, 05:25:44 PM
How's this... it was an interim situation, anyway, and the hardware that's SUPPOSED to go into the DMZ just arrived. Thankfully, I know who to ask about getting the right IP address...
Title: Re: Guest Wireless Security Rant
Post by: wintermute000 on April 21, 2015, 06:49:05 AM
(puts on router guy hat)

run a separate DNS in your external zone - possibly even from a humble router as a dns forward proxy, then create host entries for your internal / RFC1918 destinations

e.g. use 1.1.1.1 for your authenticator, and have a router in your external zone do DNS for guest, this router has a static entry for 'authenticator.deanwebbs.com' = 1.1.1.1, WLC dishes out authenticator.deanwebb.com as the landing page


bonus points, use the same R&S infrastructure except with guest VRF


my VAR deploys this design quite often
Title: Re: Guest Wireless Security Rant
Post by: deanwebb on April 28, 2015, 10:50:44 AM
To save time and $$$, we're going to re-do policy to permit this one feature. Nothing like having accounting be the ultimate network architect team.
Title: Re: Guest Wireless Security Rant
Post by: icecream-guy on April 28, 2015, 12:41:09 PM
Quote from: deanwebb on April 28, 2015, 10:50:44 AM
To save time and $$$, we're going to re-do policy to permit this one feature. Nothing like having accounting be the ultimate network architect team.


..and here I thought it was the lawyers that yielded the ultimate network architecture powers..
Title: Re: Guest Wireless Security Rant
Post by: deanwebb on April 28, 2015, 01:30:11 PM
Them too. But respect the power of accounting! They took a hardware-only solution and turned it into a nearly VM-only solution, among other things.
Title: Re: Guest Wireless Security Rant
Post by: icecream-guy on April 28, 2015, 02:35:58 PM
Quote from: deanwebb on April 28, 2015, 01:30:11 PM
Them too. But respect the power of accounting! They took a hardware-only solution and turned it into a nearly VM-only solution, among other things.

so they didn't have to buy hardware???  LOL.  virtualized it all.... what a cost savings...
Title: Re: Guest Wireless Security Rant
Post by: deanwebb on April 28, 2015, 03:17:29 PM
HUGE cost savings. Time savings, too, since software has an expedited approval process relative to hardware.
Title: Re: Guest Wireless Security Rant
Post by: wintermute000 on April 29, 2015, 02:46:45 AM
Just make sure your VM guys spec their environment appropriately including storage performance/redundancy.
Title: Re: Guest Wireless Security Rant
Post by: deanwebb on April 29, 2015, 10:14:03 AM
Quote from: wintermute000 on April 29, 2015, 02:46:45 AM
Just make sure your VM guys spec their environment appropriately including storage performance/redundancy.
And that ain't easy, let me tell you...
Title: Re: Guest Wireless Security Rant
Post by: icecream-guy on April 29, 2015, 11:10:43 AM
Quote from: deanwebb on April 29, 2015, 10:14:03 AM
Quote from: wintermute000 on April 29, 2015, 02:46:45 AM
Just make sure your VM guys spec their environment appropriately including storage performance/redundancy.
And that ain't easy, let me tell you...

(in a hush, hush whisper voice, I said)
I get the feeling that there is no hardware, it's all virtual.
Title: Re: Guest Wireless Security Rant
Post by: deanwebb on April 29, 2015, 01:04:48 PM
We caught a guy trying to smuggle out 192GB in virtual RAM and over 5TB in virtual hard drives. There was nothing in his bag, we caught him red-handed.